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IN THE CLAIMS ; 

Please amend claims 1, 8, 20, 21, and 23 as indicated 
below. 

Please cancel claims 7 and 22 without prejudice. 
A listing of the status of all claims 1-24 in the present 
patent application is provided below. 

1. (Currently Amended) A method for assembling fragmented 
network traffic, comprising: 

detecting, by a monitoring node, an anomaly in the 
fragmented network traffic whereby two or more fragments within 
the fragmented network traffic have overlapping offsets; 

performing a query [ [ , ] ] of a destination node by the 
monitoring node [ [ , ] ] to determine configuration information 
associated with how [[a]] the destination node^ to which the two 
or more fragments are addressed^ is configured to reassemble 
overlapping fragments, wherein the monitoring node is different 
from the destination node; and 

reassembling the two or more fragments by the monitoring 
node according to the configuration information associated with 
the destination node. 

2. (Canceled) 
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3. (Previously Presented) The method as recited in claim 1 
wherein determining that said two or more fragments have 
overlapping offsets comprises reading a header value associated 
with one of the fragments. 

4. (Previously Presented) The method as recited in claim 3 
wherein the header value comprises an offset value. 

5. (Previously Presented) The method as recited in claim 1 
wherein detecting an anomaly comprises determining that said two 
or more fragments overlap and that at least two of said 
fragments comprise different data for an overlapping portion of 
said fragments. 

6. (Canceled) 

7. (Canceled) 

8. (Currently Amended) The method as recited in claim 1 
wherein performing a query further includes querying an 
information base. 
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9. (Canceled) 

10. (Previously Presented) The method as recited in claim 1 
further including processing the anomaly to determine whether 
the fragmented network traffic is associated with a threat. 

11. (Previously Presented) The method as recited in claim 1 
further including performing an action on the fragmented network 
traffic based on whether the fragmented network traffic is 
associated with a threat. 

12. (Previously Presented) The method as recited in claim 1 
further including discarding at least a portion of the 
fragmented network traffic if the fragmented network traffic is 
associated with a threat. 

13. (Previously Presented) The method as recited in claim 1 
further including copying one or more fragments comprising the 
fragmented network traffic to a buffer. 

14. (Previously Presented) The method as recited in claim 1 
further comprising sending an alert if an anomaly is detected. 
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15. (Previously Presented) The method as recited in claim 1 
further comprising determining whether the fragmented network 
traffic should be blocked. 

16. (Previously Presented) The method as recited in claim 1 
further comprising determining whether the fragmented network 
traffic should be forwarded to the destination node. 

17. (Canceled) 

18. {Previously Presented) The method as recited in claim 1 
further comprising determining that two or more fragments 
contained in said fragmented network traffic have overlapping 
portions . 

19. (Previously Presented) The method as recited in claim 1 
wherein detecting an anomaly comprises determining that two or 
more fragments contained in said fragmented network traffic have 
mismatching overlapping portions. 

20. (Currently Amended) A system for assembling fragmented 
network traffic, comprising: 
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a memory configured to store at least a portion of the 
fragmented network traffic; and 

a processor configured to: 

detect, by the monitoring node, an anomaly in the 
fragmented network traffic whereby two or more fragments within 
the fragmented network traffic have overlapping offsets; 

perform a query [[,]] of a destination node by the 
monitoring node [ [ , ] ] to determine configuration information 
associated with how [ [a] 3 the destination node^ to which the two 
or more fragments are addressed^ is configured to reassemble 
overlapping fragments, wherein the monitoring node is different 
from the destination node; and 

reassemble the two or more fragments by the monitoring 
node according to the configuration information associated with 
the destination node. 

21. (Currently Amended) A non- transitory computer readable 
storage medium comprising computer instructions for assembling 
fragmented network traffic, including instructions for: 

detecting, by a monitoring node, an anomaly in the 
fragmented network traffic whereby two or more fragments within 
the fragmented network traffic have overlapping offsets; 
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performing a query[[,]3 of a destination node by the 
monitoring node [ [ , ] ] to determine configuration information 
associated with how [ [a] ] the destination node^ to which the two 
or more fragments are addressed^ is configured to reassemble 
overlapping fragments, wherein the monitoring node is different 
from the destination node; and 

reassembling the two or more fragments by the monitoring 
node according to the configuration information associated with 
the destination node. 

22. (Canceled) 

23. (Currently Amended) The system of claim 20 wherein 
performing a query further includes querying an information 
base . 

24. (Previously Presented) The method of claim 1, further 
comprising initiating expanded buffering of fragments contained 
in said fragmented network traffic in response to detecting the 
anomaly . 
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